Open source software — code that is made freely available to the public to use or modify — is the foundation of the modern internet. It’s given us a world that is more innovative and more accessible. Yet the very openness that makes the digital world accessible to everyone, also leaves it uniquely vulnerable to security threats and cyber attacks.

At Google, we’ve been working to solve this paradox for years — and have arrived at the conclusion that modern digital security actually can come through embracing openness. We protect more people online than anyone, and we recently announced a $10 billion investment in making the internet safer and more secure. But with the dramatic rise of state-sponsored cyber attacks and malicious actors online, it’s clear that we not only need stronger public-private partnerships — but dynamic policy frameworks to shore up security for everyone.

That’s why we welcome efforts by the U.S. Government to advance open source software security, such as the Securing Open Source Software Act introduced in the Senate last month. This bipartisan bill proposes the creation of a framework to guide the federal government in their use of open source software. The proposed legislation reflects a helpful focus on security and cyber risk mitigation to respond to a recent spike in malicious cyber activity against the software supply chain.

We are glad to see a continued emphasis on the importance of open source software security from the U.S. Government, and we hope that both public and private organizations will follow their lead to promote improved cybersecurity for the ecosystem at large.

The problem of securing open source

The world of open source software development allows collaboration and rapid innovation by sharing solutions freely. This community, built on openness and sharing, contributes an enormous amount of code to a majority of the applications we use today.

However, despite the benefits of this openness, the unprecedented scale of recent attacks has emphasized gaps in infrastructure and tooling and the need for improved transparency into the security practices and attributes of open source projects. Seemingly simple questions about the open source supply chain are still difficult to answer:

• Does a project contain known vulnerabilities?
• Are the project’s maintainers and community following security best practices during software development?
• What open source dependencies are part of a particular piece of software?
• How secure was the distribution supply chain?

Answering these questions requires specialized technical skills and capabilities, and given the primarily volunteer-driven nature of the open source community, we cannot expect open source developers to shoulder the full burden of advancing software security on their own.

Continued advances

Through our work with multiple industry collaborators, Google has helped create free tools, services and best practices to make it easier for the open source community to develop and distribute software securely, while providing consumers with information about the security of the software they use.

We envision a more secure future where the burden of security is shared, and there is increased trust in and resilience of the open source software ecosystem. To get there, we need freely available, automated solutions that make developer’s lives easier, such as:

• Infrastructure that prevents tampering, by default, when software is being built and released
• Advances in vulnerability discovery and management that automate finding, tracking and fixing bugs for developers
• Seamless connections across sources of security data and tools for analysis so consumers can have meaningful insight into the security of their software

We’re currently working to make these solutions a reality, at scale, with little to no additional work for developers.

Sustaining the community

We hope that the framework that will emerge due to U.S. Government efforts drives further investments in open source communities by both the public and private sectors. We’re already seeing the impact of the $100M Google pledged to non-profit organizations and software foundations like the Open Source Security Foundation to support open source creators.

This pledge backs efforts like our “open source maintenance crew,” a team of developers who spend 100 percent of their time directly enabling critical open source projects to adopt key security improvements. It also supports our Linux Kernel team, which continues to drive efforts to eliminate entire classes of bugs from open source code, including paving the way for greater memory safety using the Rust language.

We encourage other major consumers of open source to follow this lead and directly invest both funds and developer time in securing open source projects and ecosystems. Furthermore, we call on other major consumers of open source, both public and private, to implement similar policies around safe open source usage as well.

Securing open source software is a shared responsibility, and we look forward to continued collaboration on this urgent, critical problem.

We’re concerned that Congress is considering legislation that would compromise Google's ability to keep users secure by default, as well as break popular features in products like Search and Maps. We’ve previously outlined how this proposal could make our services less helpful and less secure, while not addressing the issues Americans care about most — like privacy, child safety and inflation. As experts gather for the RSA Conference this week, I wanted to share my perspective as a security professional on the real risks that this legislation poses for US security.

Our security teams work around the clock, around the world, to identify and stay ahead of threats to our users and platforms. On a typical day, Google blocks more than 100 million phishing attempts across our platforms and tracks over 270 government-backed threat actors from more than 50 countries. This work requires us to make judgment calls quickly, based on indicators and alerts from a huge variety of sources. We don’t always find fire where there’s smoke. But we do prevent millions of attacks from succeeding — and responding to the smoke without hesitation is critical to protecting millions of internet users.

A bill introduced in the Senate (S. 2992) could hurt our ability to make quick decisions to keep our products secure, requiring us to ask: would thwarting a potential bad actor violate the law and open us up to legal liability? Even pausing to ask the question would leave millions of users vulnerable for precious minutes while a potential security threat persists. And when it comes to cybersecurity, every second counts.

Here are just a few ways the legislation would undermine our ability to keep people safe:

Harming a security-by-default approach

First, because the bill bans basic product integration, we might not be able to secure our products by default. This is problematic because modern threat actors don’t just seek to exploit one user, service or system in isolation. They look for weak links, and their behavior is harder to detect when their activities are spread across multiple providers. That’s why we build systems with integrated security defenses. For example, to counter a phishing attack, we rely on built-in spam filtering, malware scanning, link analysis, two-step verification for accounts, password alerts … the list goes on. Under the legislation, these seamless integrations could be prohibited simply because competitors offer their own versions of spam filtering, malware scanning and other security services. The bill could even require us to open our systems to untrusted and potentially vulnerable rival services.

Opening our products to bad actors

Second, the bill would require us to allow outside parties to “access or interoperate” with our “platform, operating system, hardware and software features.” This broad mandate to open our systems may have been written with domestic rivals in mind – but it would inevitably be exploited by foreign companies looking to understand US technical infrastructure, and access data from American businesses and citizens. As national security leaders have warned:“Unfettered access to software and hardware could result in major cyber threats, misinformation, access to data of U.S. persons, and intellectual property theft.”

Rolling back efforts to fight disinformation

Third, by prohibiting us from “discriminating” against competitors, the bill would prevent us from taking action against purveyors of malicious content. Since Russia invaded Ukraine, we have been able to move quickly to limit Russian propaganda and disinformation, even as that content has migrated to new channels. The proposed legislation could undermine this work.

Failing to address valid security concerns

Finally, this bill would create a legal environment that encourages companies to err on the side of not protecting users – and recent changes to the bill exacerbate these underlying security concerns. For example, the revised bill says that we don’t have to interoperate with or provide access to data to entities who pose “clear” and “significant” security risks. But this assumes that we know in real time which risks are significant, and could prohibit us from blocking moderate or emerging security risks that don’t obviously meet the bar of a “significant” threat. Another recent change says that we don’t have to open our platforms up to businesses backed by the Chinese government. But this ignores the fact that modern threat actors use compromised third-parties or shell companies to conduct operations, where attribution can be slow and difficult.

We understand there’s an appetite for global regulation, and we support balanced, thoughtful legislation to solve important issues such as consumer privacy and child safety online. But this legislation would fundamentally harm our ability to stay ahead of threats and keep the billions of people who use our products secure. We strongly urge Congress to consider these unintended consequences before moving forward.

The following is adapted from remarks delivered by Royal Hansen, Vice President of Engineering for Privacy, Safety and Security during his keynote United in Cyberpower: The Role of Companies in Building a Cybersecure World at Cybersec Europe 2022 in Katowice, Poland.

I believe cybersecurity is one of the top issues facing the world today and I’d like to share a bit about why it’s so important for companies, countries, and communities of all sizes to work together.

This is particularly true right here in Central and Eastern Europe where the Russian invasion of Ukraine has brought these issues into sharp focus. I’m honored to be here today and to get to meet with so many of you who are working on this day in and day out.

As governments in this region and elsewhere in the world tackle this issue we want to ensure we are doing everything we can to support those efforts. Google’s mission has always been about organizing the world's information and making it universally accessible and useful. The work we’re doing to ensure people can get access to quality information–and do so safely–has never been more important than it is today.

Securing users in Ukraine and the broader region

As the Russian invasion of Ukraine unfolded, Google mobilized to help the people of Ukraine and protect the security of our users and services – an area where we are uniquely positioned to help in this conflict.

We have our own specialized teams dedicated to identifying, tracking, and countering threats from government-backed actors.

Russia-backed hacking and influence operations are not new to us; we’ve been tracking and taking action against them for years. To put this into perspective, we’ve seen and worked to disrupt Russian operations targeting the U.S. elections in 2016 and 2017 and campaigns targeting the 2018 Olympic games. In October, we blocked a Russian campaign targeting 14,000 Google users.

And we’ve seen first hand the targeting of Ukraine by Russia. It has been ongoing for years with both espionage and occasional cyber attacks tracked by our teams. As the war intensified, we also saw Russian threat actors shift focus to targets elsewhere in Eastern Europe.

Our Threat Analysis Group (TAG), regularly publishes details on campaigns it detects, and disrupts these efforts to help governments and private sector companies better defend their systems.

We’ve seen threat actors beyond Russia shift their focus and targeting, including a growing number of threat actors using the war as a lure in phishing and malware campaigns. This includes government-backed actors from China, Iran, North Korea, Belarus and financially-motivated, criminal actors using current events as a means for targeting users.

For example, we’ve seen one cyber crime group impersonating military personnel to extort money for rescuing relatives in Ukraine.

In addition to disrupting threats, we are doing everything we can to increase protections for high risk users and organizations in Ukraine. We’ve redoubled our efforts to offer free tools to help – including protecting hundreds of high risk users on the ground with our Advanced Protection Program, and expanding eligibility of Project Shield to include the Ukraine government. Shield is currently protecting over 200 websites in Ukraine from distributed denial of service attacks.

It is in this spirit of action that we are expanding our partnerships and investment in the broader region on cybersecurity.

In fact, this week a delegation of our top security engineers and leaders are on the ground across Eastern Europe to provide hands-on training to high risk groups, deliver security keys and support local businesses as they look to improve their security posture.

To share what we know about the threat, we are engaging in technical exchanges with governments in the region.

We’re providing free tools and expertise to democratic institutions and civil society, such as the Protect Your Democracy Toolkit - which we launched today in partnership with our Jigsaw team.

We’re also investing in, and shaping, the next generation of cybersecurity professionals. For example, Google has committed to provide scholarships for 150,000 people in Europe, the Middle East and Africa through the new Google Career Certificate training.

We’re also helping governments and businesses stay ahead of the threat, including helping government agencies, companies and utilities who rely on outdated hardware and software to replace old systems with better foundations and we are here to build up businesses and governments’ confidence to embrace digital transformation securely.

Google’s approach to security

We believe we are uniquely positioned to help users, organizations, and governments in this region because of our approach to security.

First, we focus on the basics. We bake in security from the beginning instead of bolting it on as an afterthought and we design helpful products that are secure by default for our users. In fact, we are the first consumer tech company to automatically turn on 2 step verification, our version of multifactor authentication, or MFA, for our users. We recommend businesses and governments focus on these fundamentals as well.

Second, we take an open and interoperable approach to security, and we invest to ensure this model of the Internet as a whole is protected. In today’s interconnected environment, our collective security is only as strong as the weakest link. Our business cannot thrive if people don’t feel safe online. That’s why we design solutions that eliminate entire classes of threats from being effective both on our platforms, and across the Internet as a whole.

Finally, and perhaps most importantly – we are looking at the future of cybersecurity and investing in advanced, state-of-the-art capabilities. We know that cyber threats evolve quickly – as soon as a new technology is introduced or adopted, there are threat actors and cyber criminals looking for ways to exploit it. That’s why it’s not enough to just stay a few steps ahead of the threat.

We need to invest in the future of technology, from cutting-edge artificial intelligence capabilities, to advanced cryptography, to quantum computing – our teams are already working on the future of cybersecurity. And we see it as part of our mission to ensure that we open source and share these findings so that organizations and governments can stay ahead of the latest cyber threats.

Security-proofing our tech policies

Our approach enables us to weather online security threats. But advanced capabilities are not enough if government policies inadvertently undermine our ability to protect users.

I support smart tech regulation, which can fuel the vitality of the Internet and ensure technology is meeting society's needs. Unfortunately, some technology regulation is not adequately considering the impact to safety and security efforts online.

For example, some policies seek to limit sharing of data between different services on platforms’ like ours, but overly-broad bans on cross-platform data sharing also have significant implications for the threat intelligence work I mentioned earlier.

The ability to share intelligence on threat actors and their technical signatures helps identify and stop the work of threat actors and cybercriminals. It protects not just one company or two companies, but the Internet as a whole.

To realize the full benefits of technology to society, society must be able to trust that the technology they are using is safe and secure. By ensuring security has a seat at the table in these policy discussions, we can strike this balance and unlock technology’s full potential. Today’s conflict and challenges point to a need for better cooperation and giving technical experts a seat at the table in these policy discussions.

We applaud the Declaration for the Future of the Internet, which calls on governments and industry to protect a future for the Internet that is open, free, global, interoperable, reliable, and secure.

At our core, Google is an Internet company, and our fate is tied to the Internet remaining true to these principles. The internet itself is a multi-stakeholder system, and protecting users and citizens online requires cooperation among us, governments and businesses.

It’s never been more urgent, and our ability to make a difference is greater than anyone anticipated. We all must work together to protect this future, whether that means combating cyber threats, building safe technologies that unlock society’s full potential, or developing responsible technology policies.

We stand ready to partner with governments, businesses, and individual users to see this future secured.